The Essential Google Cloud & SAIF AI Launch Checklist for 2026 Success (2/3) • William OGOU Cybersecurity Blog

Part 2 of our Google Secure AI Framework (SAIF) Series.

In Part 1, we unpacked the philosophy behind Google’s Secure AI Framework (SAIF). Now, we stop talking theory and start building.

Day 1 of an AI project is where security is won or lost. Starting an AI project without a security plan is technical debt that accumulates interest daily. Retrofitting security into a deployed LLM agent or a training pipeline is painful, expensive, and often ineffective.

Whether you are a Tech Lead setting up the repo, a Dev writing the first line of Python, or a Security Architect defining policy, you need a plan. Based on the technical implementation of SAIF, we have compiled the exhaustive master checklist for starting a new AI project in Google Cloud.

Know Your Project Typology: Creator vs. Consumer

Before you check a single box, define your archetype. The risks differ significantly, and your role dictates your focus:

The Model Creator: You are training foundation models or fine-tuning (e.g., using Vertex AI custom training).
- Primary Risks: Data poisoning, Model theft, Supply chain attacks.
- Focus: Data sanitization, training infrastructure hardening, model registry hygiene.
The Model Consumer: You are building apps that call models (e.g., Gemini API, Vertex AI Agent Builder).
- Primary Risks: Prompt injection, Sensitive data leakage via prompts, Rogue agent actions.
- Focus: Input/Output validation, Access Control, Application-layer WAF, User privacy.

TL;DR Checklist

Domain	Requirement
Identity	Dedicated Service Accounts created for the AI workload with Least Privilege (restricted permission and not default service accounts).
Data	Training/RAG data buckets remove public access prevention and ensure data are encrypted with CMEK.
Network	VPC Service Controls perimeter established around BigQuery, GCS, Vertex AI, and associated services.
Supply Chain	Artifact Registry enabled with automatic vulnerability scanning for containers.
Model Safety	Content Safety Filters configured to “Block Most” and Model Armor enabled for input sanitization.
Apps	Identity-Aware Proxy (IAP) enabled for AI web apps and Cloud Armor for DDoS protection and web attacks.
Logging	Data Access and Audit Logs enabled for the whole project and any associated projects.
Threat Detection	Security Command Center (SCC) Premium enabled with AI-specific modules to detect real-time anomalies and infrastructure misconfigurations.
Compute (Bonus)	Confidential VMs enabled for all training/hosting nodes.

The 17-Points Google SAIF AI Security Checklist

Here is how to implement SAIF controls technically using Google Cloud primitives, organized by domain.

PHASE 1: Data Controls (The Foundation)

Critical for Model Creators and RAG implementers.

1. Restrict Training Data Storage Access Ensure data used for training or RAG is locked down. Remove public access prevention on Storage Buckets immediately.

Project Typology: Creator & Consumer.

gcloud storage buckets update gs://[YOUR_TRAINING_DATA_BUCKET] \
--public-access-prevention

2. Sanitize Sensitive Info (DLP) Don’t train on PII. Don’t let agents see credit card numbers. Set up a Sensitive Data Protection (DLP) job to inspect data before ingestion.

Project Typology: Creator.

# Create a simple inspection template for PII
gcloud dlp inspect-templates create \
--display-name "ai-training-data-sanitization" \
--info-types "EMAIL_ADDRESS,PHONE_NUMBER,CREDIT_CARD_NUMBER"

3. Implement Life-Cycle Management Don’t store user prompts forever. Set Object Lifecycle Management on logs/prompt storage buckets to auto-delete after a set retention period (e.g., 30 days).

Project Typology: Consumer.

# Apply a JSON lifecycle policy to delete objects > 30 days
gcloud storage buckets update gs://[PROMPT_LOGS_BUCKET] \
--add-lifecycle-rule="action={type=Delete},condition={age=90}"

4. Data Governance & Privacy Maintain a unified view of data assets and use advanced privacy techniques for highly sensitive data.

Project Typology: Creator.
Action: Register datasets in Dataplex for centralized policy enforcement.

Bonus: Vertex AI managed datasets Provide a centralized, controlled environment for ML data lifecycles with built-in lineage tracking and lifecycle management.

Project Typology: Creator.
Action: Use Vertex AI managed datasets to centrally organize and version data, linking it to models for a full audit trail. Leverage integrated labeling tools to ensure consistency and reduce bias.

PHASE 2: Infrastructure Controls (The Fortress)

Where the model lives and learns.

5. Secure the Supply Chain (Integrity) Prevent “Model Source Tampering” by ensuring you only deploy trusted containers. Enable Artifact Analysis to scan for CVEs.

Project Typology: Creator & Consumer.

gcloud services enable containerscanning.googleapis.com

gcloud artifacts docker images scan [REGION]-docker.pkg.dev/[PROJECT_ID]/[REPO_NAME]/[IMAGE_NAME]:[TAG]

gcloud artifacts docker images list-vulnerabilities [REGION]-docker.pkg.dev/[PROJECT_ID]/[REPO_NAME]/[IMAGE_NAME]:[TAG]

6. Harden the Compute Environment Protect data in use. Enforce Confidential VMs to encrypt memory during processing, ensuring that sensitive data and model weights remain encrypted in RAM.

Project Typology: Creator (Training) & Consumer (Hosting).

Code:

gcloud compute instances create [INSTANCE_NAME] \
  --confidential-compute \
  --maintenance-policy=TERMINATE

7. Define the Perimeter (VPC-SC) Stop data exfiltration even if credentials leak. This is the single most effective control against model theft.

Project Typology: Creator & Consumer.
Action: Create a Service Perimeter that includes Vertex AI API, BigQuery API, and Cloud Storage API. Only resources inside the perimeter can talk to each other.

8. Encryption (CMEK) Protect data at rest.

Project Typology: Creator & Consumer.
Action: Use Customer-Managed Encryption Keys (CMEK) via Cloud KMS for storage buckets, BigQuery Datasets/Tables and Vertex AI resources to maintain control and ensure sovereignty.

9. Centralize Inventory (No Shadow AI)

Project Typology: Creator.
Action: Use Vertex AI Model Registry for all custom models. Do not leave .h5 or .bin files scattered in random storage buckets. This ensures versioning, lineage, and a single point of deployment. Also, use Cloud Asset Inventory to maintain a real-time inventory of all AI-related resources across projects.

PHASE 3: Model Controls (The Brain)

Resilience: Hardening the model against attacks.

10. Block Prompt Injection (Input Validation) Don’t let users hijack your agent.

Project Typology: Consumer.
Action: Deploy Model Armor (or configure a “AI Guard Model”) to sanitize inputs before they reach the LLM. Ensure your architecture routes all LLM calls through this governance layer, never directly from client to model.

11. Output Sanitization & Grounding Prevent the model from generating harmful content or hallucinations.

Project Typology: Consumer.
Action: Configure Safety Filters in Vertex AI (block hate speech, dangerous content) and enable Grounding (check against enterprise data or Google Search) to verify facts and reduce hallucinations.

Bonus: Use Third Party AI Secuirty Assessments Tools In addition to Google Cloud’s built-in tools, consider integrating third-party AI security assessment tools like

Giskard into your development pipeline.
Promptfoo for prompt security evaluation and Strix for application vulnerability scanning.
Trivy for container and dependencies vulnerability scanning.

These tools can provide advanced testing capabilities, including semantic evaluations and compliance checks that complement SAIF principles.

PHASE 4: Application Controls (The Interface)

Protecting the inputs and outputs.

12. Enforce Least Privilege for Agents If an agent goes rogue, limit the blast radius. Do not give it Editor or Owner roles.

Project Typology: Consumer.

Code:

# 1. Create the account
gcloud iam service-accounts create ai-agent-sa --display-name="AI Agent Identity"

# 2. Bind strict roles (Example: Read-only access to specific bucket)
gcloud storage buckets add-iam-policy-binding gs://[RAG_KNOWLEDGE_BASE] \
  --member="serviceAccount:ai-agent-sa@[PROJECT_ID].iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"

13. Secure Application Access (IAP) Ensure only authorized users can reach the AI app.

Project Typology: Consumer & Creator.
Action: Deploy Identity-Aware Proxy (IAP) to enforce zero-trust access controls without relying on public IPs or VPNs.

14. Cloud Armor Protect AI endpoints from web attacks and DDoS.

Project Typology: Consumer & Creator.
Action: Use Cloud Armor to set up WAF rules for AI application endpoints, blocking common threats like SQL injection or cross-site scripting (XSS) and rate-limiting requests to prevent DDoS attacks.

PHASE 5: Assurance & Governance (The Oversight)

Validation and continuous monitoring.

15. Enable Observability You can’t fix what you can’t see.

Project Typology: Creator & Consumer.
Action: Enable Cloud Logging for all associated services in the project. Specifically, toggle Audit Logs and Data Access Logs to track who is using the model and what data is being accessed.

16. Continuous Threat Detection Detect threats in real-time.

Project Typology: Consumer.
Action: Enable Security Command Center (SCC) Premium with specific modules for AI workloads to detect anomalies, unusual data access patterns and infrastructure misconfigurations.

17. Governance & Policy Automate compliance and build trust.

Project Typology: Consumer and Creator.
Action: Use Organization Policy to restrict unauthorized AI usage (e.g., disabling Service Account key creation, restricting resource usage to specific geographic regions, restricting public IP creation).

In addition, you can publish Model Cards detailing limitations and data sources of your AI model or project to build trust with users.

Summary Table

Phase & Control	Purpose / Security Goal	Key Actions / Tools	Project Typology
1. Restrict Training Data Access	Prevent unauthorized access to training/RAG data	Enforce Public Access Prevention on storage buckets	Creator & Consumer
2. Sanitize Sensitive Info (DLP)	Avoid training on sensitive or PII data	Run DLP inspection jobs to detect PII before ingestion	Creator
3. Lifecycle Management	Limit data retention to reduce risk	Set object lifecycle policies for prompt/log buckets	Consumer
4. Data Governance & Privacy	Centralize dataset control & enforce policies	Register assets in Dataplex, govern data centrally	Creator
Bonus: Vertex AI Managed Datasets	Maintain lineage, versioning & consistent labeling	Use Vertex AI datasets with built-in metadata workflows	Creator
5. Secure Supply Chain	Prevent malicious or vulnerable artifacts	Enable Artifact Analysis / CVE scanning on containers	Creator & Consumer
6. Harden Compute (Confidential VMs)	Protect data in use during training/hosting	Use Confidential Compute to encrypt memory at runtime	Creator & Consumer
7. Define the Perimeter (VPC-SC)	Block data exfiltration outside trusted boundaries	Apply VPC Service Controls around AI & storage APIs	Creator & Consumer
8. Encryption (CMEK)	Retain control of encryption keys and data sovereignty	Use Customer-Managed Encryption Keys (CMEK) for buckets, BigQuery, Vertex AI	Creator & Consumer
9. Centralize Inventory (Model Registry)	Eliminate shadow artifacts and enhance traceability	Store models in Vertex AI Model Registry & audit with Asset Inventory	Creator
10. Block Prompt Injection (Input Validation)	Stop malicious or malformed prompts	Deploy Model Armor / guard layer for input validation	Consumer
11. Output Sanitization & Grounding	Reduce harmful output and hallucinations	Configure safety filters & grounding checks (e.g., against enterprise data)	Consumer
Bonus: Third-Party AI Security Tools	Extend testing for security & compliance	Integrate Promptfoo, Giskard, Strix, Trivy	Creator & Consumer
12. Least Privilege for Agents	Limit blast radius of rogue agents	Assign least privilege via strict IAM roles	Consumer
13. Secure App Access (IAP)	Enforce zero-trust access to apps	Enable Identity-Aware Proxy (IAP)	Consumer & Creator
14. Cloud Armor	Protect apps from external attacks	Use Cloud Armor WAF & DDoS controls	Consumer & Creator
15. Observability	Visibility for audit and incident analysis	Enable Cloud Logging, Audit logs, Monitoring	Creator & Consumer
16. Continuous Threat Detection	Real-time detection of anomalies & misconfigs	Use Security Command Center (SCC) Premium	Consumer
17. Governance & Policy Automation	Prevent unauthorized AI usage and enforce policies	Apply Organization Policy constraints & publish Model Cards	Creator & Consumer

Conclusion: Ready to Build “SAIF” AI Projects on Google Cloud

By following this checklist, you aren’t just deploying an AI project. You are deploying a secure AI project. You have successfully mapped the theoretical risks of SAIF (Data Poisoning, Exfiltration, Prompt Injection) to concrete Google Cloud services (DLP, VPCSC, IAM, Model Armor).

What’s Next? A checklist is great, but seeing it in action is better. In the final part of our series, How to Build a Secure AI Platform on Google Cloud: SAIF Step-by-Step Guide we will walk through a real-world architecture diagram, showing exactly how these components wire together to protect a GenAI Financial Advisor app.

To further enhance your cloud security and implement Zero Trust, contact me on LinkedIn Profile or [email protected]

🎄 Happy Christmas and Secure AI Building!

Frequently Asked Questions (FAQ)

How do I secure my AI training data in Google Cloud?

You should remove public access from Storage Buckets, sanitize sensitive info using DLP (Data Loss Prevention), and implement strict lifecycle management to auto-delete old data.

What is the best way to prevent model theft on GCP?

The single most effective control is establishing a VPC Service Controls (VPC-SC) perimeter around your Vertex AI and storage resources to prevent unauthorized data exfiltration.

How can I block prompt injection attacks?

Deploy Model Armor or a guard model to sanitize inputs before they reach the LLM, and route all calls through this governance layer rather than directly from the client.

What role should I assign to my AI agent service account?

Always enforce Least Privilege. Create a dedicated service account and assign only the specific permissions needed (e.g., `roles/storage.objectViewer` for read-only access), avoiding broad roles like `Editor` or `Owner`.

How do I monitor who is using my AI model?

Enable Cloud Logging for Vertex AI and specifically toggle Audit Logs for "Data Access" to track user activity and data access patterns.